Is it possible the javascript vulnerability had caused any other bugs with addresses? I sent one to your Hot Potato when it was at 13.5~, that was definitely yours (it's popped up several times in the past), and was unable to get the 'verifying payment' to show up.

Of course an email was sent, mind you I may have mislabelled the title as I didn't know about this JS attack until just now. Still waiting on my other refunds too.